ACTA: The Fact Controller speaks ...

On Saturday the online Official Journal of the European Union carried the Opinion of the European Data Protection Supervisor (EDPS) on the current negotiations by the European Union of an Anti-Counterfeiting Trade Agreement (ACTA), which you can read in full here. The EDPS isn't interested in intellectual property, counterfeiting or any of the other things that concern the IP community -- but he is highly concerned about anything to do with information. Issues such as transparency and the extent to which personal data can be stored, shared and used are very much on his mind.

The EDPS is charged with looking at all proposed EU law, and commitments which the EU considers making, with a view to commenting on the extent to which it complies with the clearly-stated objectives of European data protection. His review of ACTA was therefore inescapable, however much secrecy the proposed agreement enjoyed in its earlier days.

The EDPS's Opinion is 13 pages in length and concludes as follows:

"81. The EDPS strongly encourages the European Commission to establish a public and transparent dialogue on ACTA, possibly by means of a public consultation ['Possibly'? If the public hasn't been properly informed up to know, consultation may not be so fruitful], which would also help ensuring that the measures to be adopted are compliant with EU privacy and data protection law requirements.

82. In the course of the ongoing negotiations on ACTA, the EDPS calls on the European Commission to strike a right balance between demands for the protection of intellectual property rights and the right to privacy and data protection. The EDPS emphasises that it is particularly crucial that privacy and data protection are taken into account from the very beginning of the negotiations before any measure is agreed upon so as not later on having to find alternative privacy compliant solutions [this emphasises that compliance with privacy issues is non-negotiable, even if the terms of ACTA are].

83. While intellectual property is important to society and must be protected, it should not be placed above individuals’ fundamental rights to privacy, data protection, and other rights such as presumption of innocence, effective judicial protection and freedom of expression [What about the consumers' right to protection against fake medicines, brake-pads etc? That's not an IP issue for them, but it is a question of survival].

84. Insofar as the current draft of ACTA includes or at least indirectly pushes for three strikes Internet disconnection policies, ACTA would profoundly restrict the fundamental rights and freedoms of European citizens, most notably the protection of personal data and privacy [the right to receive information is presumably omitted since it falls outside the remit of the EDPS].

85. The EDPS takes the view that three strikes Internet disconnection policies are not necessary to achieve the purpose of enforcing intellectual property rights. The EDPS is convinced that alternative, less intrusive solutions exist or, at least, that the envisaged policies can be performed in a less intrusive manner or at a more limited scope, notably through the form of targeted ad hoc monitoring [The EDPS is not concerned with efficiency or cost of enforcement. How many tens of millions of people can be ad-hoc monitored before IP rights are unenforceable?].

86. The three strikes Internet disconnection policies are also problematic on a more detailed legal level in particular as the processing of judicial data, notably by private organisations, must be based on an appropriate legal basis. The operation of three strikes schemes may further entail the storage of log files on a longer term, which would be contrary to existing legislation [Isn't longer-term storage permitted where justifiable?].

87. Furthermore, as far as ACTA involves exchanges of personal data between authorities and/or private organisations located in the signatory countries, the EDPS calls on the European Union to implement appropriate safeguards. These safeguards should apply to all data transfers made in the context of ACTA — whether they are in the field of civil, criminal, or digital law enforcement — and should be in accordance with the data protection principles set forth in Convention No 108 and Directive 95/46/EC. The EDPS recommends that such safeguards take the form of binding agreements between EU senders and third country recipients.

88. The EDPS further wishes to be consulted on the measures to be implemented in respect of the data transfers that will take place under ACTA in order to verify their proportionality, and that they guarantee an adequate level of data protection. The EDPS further wishes to be consulted on the measures to be implemented in respect of the data transfers that will take place under ACTA in order to verify their proportionality, and that they guarantee an adequate level of data protection".

So now you know. The IPKat has done a quick search of 'ACTA' and 'EDPS' together as news terms, but this search has thrown up no 'hits'. How strange, observes Merpel, that when three controversial issues -- ACTA, three strikes and data protection -- all come together in one document, the world's main news resources are so coy.

The Fact Controller here
The Fat Controller here
The Cat Controller here

French pass Loi Hadopi

The IPKat, tipped off by his friend Hugo Cox, learned that The Register has provided English-language coverage of today's breaking news that France has passed the controversial 'three-strikes-and-you're-out' law, designed to stamp out rampant file-sharing and illegal downloading of copyright-protected works [for other perspectives on the three strikes solution see posts here and here]

The new law is nicknamed the loi Hadopi, because it creates a "High Authority" (Haute autorité pour la diffusion des œuvres et la protection des droits sur Internet), which will monitor and regulate the use of the internet in France. According to The Register,

"The principle behind the law is simple. Anyone suspected of illegal downloading of material on the internet will receive two letters: a first and a second warning. The first warning will recommend that the user check to make sure that no one is surfing on the back of an unsecured Wi-Fi connection: but it will also point out that it is the subscriber’s responsibility to make sure their net access is properly safeguarded".

This has come a bit too late in the day for this Kat to get his analytical claws into the clauses, but he suspects that there may be a comment or two by the time he logs on again tomorrow night.

The Eircom settlement -- just a Will o' the ISP?

Browsing through last week's World Media Law Report the IPKat spotted that the copyright infringement action brought in Ireland by recording companies EMI,SONY BMG, Universal Music and Warner against Eircom, Ireland’s flagship internet service provider, was settled at the end of January. The four rights-owners had sued Eircom under the Copyright and Related Rights Act 2000, seeking to restrain the ISP from infringing by making available copies of their recordings to the public through Eircom’s internet service facilities but without their consent. This made a change from the usual actions that were brought against individual illegal downloaders.

To the disappointment of many, the trial -- scheduled for four weeks in court -- only ran for eight days before it settled on terms (here) that Eircom would operate a “three strikes and you are out” regime against any of its customers who upload/download music illegally. Meanwhile, the record companies will deploy a service that poses as a P2P file sharer in order to entrap and identify illegal downloaders. Once Eircom gets the identified IP addresses, it will have to notify the fingered subscribers that they have been identified as infringers, warning them that unless the activity ceases their subscription will be disconnected -- the ultimate punishment.

The record companies had wanted Eircom to install special software to detect the unique “fingerprint” of illegal up/downloaded copyright music files but Eircom refused, saying it was not technically feasible and that it would have interfered with the operation of its network and services. As things stand, Eircom does not have to provide details of any of its subscribers who are suspected of copyright infringement to the music industry, since this would give rise to significant privacy and data protection implications.

The IPKat suspects that, in the long haul, this settlement will make very little difference to the vast majority of file sharers. Those who are law-abiding can sleep soundly anyway; the small-timers who infringe a little bit here and there remain below the threshold above which legal action makes sense for the copyright owners, while the serious infringers will exercise their ingenuity in order to persist in their activity, whether through multiple accounts, identity thefts or anything else. That's not to say that it's not important, though: it establishes the principle that at least one Irish ISPs is not merely a neutral carrier, but has a commitment to cooperate with the copyright owners. How far this principle can be meaningfully exploited by the recording companies will presumably become apparent over the next couple of years.

After Eircom, what about the other Irish ISPs? Click here for more
Has Eircom betrayed its subscribers? Find out here